ensure api calls passing credentials